A complete solution to package and build a ready for distribution Electron app with “auto update” support out of the box
This report summarizes scanner evidence for electron-userland/electron-builder, a TypeScript project with 14,666 GitHub stars. SynthScan examined 200,135 lines of code across 997 source files, recording 575 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 6.1 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 257 finding(s).
Are imports declared and package/API names verified? 37 finding(s).
Are wrappers, guards, and repeated structures necessary? 464 finding(s).
Which changes need focused human review? 575 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 575 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/vitest-scripts/test-summary.ts | 236 | // ── rendering ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 12 | // ─── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 21 | // ─── Platform filter ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 61 | // ─── Snapshot cleanup ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 94 | // ─── File list ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 123 | // ─── CLI ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 17 | // ─── Test fixture paths ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 136 | // ─── Unit tests ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 170 | // ─── Additional logic-path tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 195 | // ─── Security: pkcs12PasswordToUtf16 encoding ──────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 222 | // ─── Security: pkcs12PbeDeriveKey key derivation ───────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 271 | // ── DoS prevention: iteration count bounds ──────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 317 | // ─── readCertInfo — multiple certificates in one PFX ───────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 334 | // ─── readCertInfo — legacy PBE error path ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 344 | // ─── readCertInfo — malformed / corrupted input ─────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 364 | // ─── rc2CbcDecrypt — known-answer tests (RFC 2268) ─────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 423 | // ─── readCertInfo — RC2-40 encrypted PFX ───────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 440 | // ─── rc2CbcDecrypt — input validation / security guards ────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 499 | // ─── pkcs12PbeDeriveKey — salt size guard ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 6 | // ─── Module mocks (hoisted by vitest above all imports) ─────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 41 | // ─── Imports ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 59 | // ─── clearCache ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 152 | // ─── wrap ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 208 | // ─── quoteString ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 232 | // ─── Command configuration ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 304 | // ─── CLI entry-point ESM smoke tests ───────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/ksuidTest.ts | 30 | // ─── Unit tests ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/differentialOneLineBenchTest.ts | 60 | // ─── parameters ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/differentialOneLineBenchTest.ts | 94 | // ─── deterministic synthetic app ────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/differentialOneLineBenchTest.ts | 283 | // ─── asar / 7z helpers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/differentialOneLineBenchTest.ts | 435 | // ─── measurement ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/differentialOneLineBenchTest.ts | 523 | // ─── reporting ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/differentialOneLineBenchTest.ts | 573 | // ─── the benchmark ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/blockmapTest.ts | 199 | // ─── Golden-output suite: JS snapshots + optional binary cross-check ───────── | COMMENT |
| MEDIUM | test/src/blockmapTest.ts | 334 | // ─── Region-aware chunking (BuildBlockMapOptions.regions) ─────────────────── | COMMENT |
| MEDIUM | test/src/extractArchiveTest.ts | 156 | // ─── extractArchive .tar.7z (snap template layout) ──────────────────────────── | COMMENT |
| MEDIUM | test/src/extractArchiveTest.ts | 210 | // ─── isSafeExtractPath ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/extractArchiveTest.ts | 258 | // ─── moveDirAtomic ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateManifestSignatureTest.ts | 126 | // ── trust lists and multi-signature manifests (key rotation) ───────────────── | COMMENT |
| MEDIUM | test/src/updateManifestSignatureTest.ts | 317 | // ── minimumSystemVersion and NSIS web-installer packages ───────────────────── | COMMENT |
| MEDIUM | test/src/updateManifestSignatureTest.ts | 449 | // ── injective canonical encoding and signed-manifest shape checks ──────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 62 | // ─── compute7zCompressArgs ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 223 | // ─── archive() — path-level guards (no binary needed) ─────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 246 | // ─── shouldPreserveSymlinks — target platform → -snl policy ────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 262 | // ─── archive() — symlink preservation (non-Windows hosts) ──────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 325 | // ─── archive() — 7z branch filter (#9983) ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 325 | // ─── archive() — 7z branch filter (#9983) ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 368 | // ─── buildExcludeArgs (via archive()) — happy-path coverage ─────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 387 | // ─── archive() — storedPaths (differential-friendly Copy members) ──────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 32 | // ─── Test helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 75 | // ─── getCacheDirectory ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 238 | // ─── shouldRetryDownloadError ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 311 | // ─── Shared temp cache dir for functional tests ─────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 325 | // ─── downloadArtifact: generic artifacts (.tar.gz) ─────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 488 | // ─── downloadBuilderToolset: filenameWithExt validation ────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 504 | // ─── Toolset archive cache (no network) ────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 622 | // ─── Checksum formats: SHA-256 hex vs base64 SHA-512 (#10040) ──────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 622 | // ─── Checksum formats: SHA-256 hex vs base64 SHA-512 (#10040) ──────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 783 | // ─── Seeded SHASUMS256 checksums (air-gapped builds, #10039) ───────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 783 | // ─── Seeded SHASUMS256 checksums (air-gapped builds, #10039) ───────────────── | COMMENT |
| 221 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/vitest-scripts/refresh-tests.ts | 63 | function deleteStaleGeneratedSnapshots(): void { | CODE |
| LOW | …cripts/runtime-tests/generate-toolset-tests-windows.ts | 209 | export function generateWindowsToolsetTests(): void { | CODE |
| LOW | …-scripts/runtime-tests/generate-toolset-tests-linux.ts | 64 | export function generateLinuxToolsetTests(): void { | CODE |
| LOW | test/src/HoistedNodeModuleTest.ts | 1074 | async function assertLazystreamKeepsNestedReadableStream(expect: ExpectStatic, resourceDir: string, extraPackages: Array | CODE |
| LOW | test/src/archiveUtilTest.ts | 487 | async function expectCompressedPassUndisturbed(expect: ExpectStatic, tmpDirPath: string, files: Record<string, string | CODE |
| LOW | test/src/asarIntegrityTest.ts | 22 | async function verifyAsarPerFileIntegrity(expect: ExpectStatic, resourceDir: string) { | CODE |
| LOW | test/src/updateInfoBuilderTest.ts | 553 | function makeAppUpdateConfigPackager(signingKeys: Array<KeyObject> = [], updateManifest?: any, publishConfig?: any): any | CODE |
| LOW | test/src/updateInfoBuilderTest.ts | 752 | function makeWinAppUpdateConfigPackager(sign: any, verifyUpdateCodeSignature = true): any { | CODE |
| LOW | test/src/publisher/PublishManagerCacheTest.ts | 50 | function getOrCreatePublisher(manager: PublishManager, publishConfig: GithubOptions) { | CODE |
| LOW | test/src/updater/differentialUpdateLinuxSuite.ts | 11 | export function registerDifferentialLinuxTests(toolset: Required<Pick<ToolsetConfig, "appimage">>): void { | CODE |
| LOW | test/src/updater/nsisUpdaterTest.ts | 1011 | async function createNsisUpdaterWithPackageType(tmpDir: TmpDir, packageType: string) { | CODE |
| LOW | test/src/updater/manifestDownloadOriginTest.ts | 161 | function captureRangeRequestHeaders(downloaderClass: typeof GenericDifferentialDownloader | typeof FileWithEmbeddedBlo | CODE |
| LOW | test/src/updater/manifestDownloadOriginTest.ts | 170 | async function differentialDownloadInstaller(updater: AppUpdater, provider: Provider<any>, info: UpdateInfo, tmpDir: T | CODE |
| LOW | test/src/updater/multipleRangeDownloaderTest.ts | 9 | function createFakeDifferentialDownloader(response: PassThrough): DifferentialDownloader { | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 213 | async function assertEmbeddedPublisherName(expect: ExpectStatic, distDir: string): Promise<void> { | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 227 | async function handleInitialInstallPerOS({ | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 473 | async function pollUntilNewVersionInstalled( | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 548 | export async function runInstallOnNextLaunchTest( | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 1157 | async function assertWebInstallerUpdateInfo(expect: ExpectStatic, dist: ApplicationUpdatePaths, version: string, perMach | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 1199 | export async function runWebInstallerUpdateTest(context: TestContext, toolsets: ToolsetConfig, extraConfig?: Partial<Con | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 1277 | export async function runWebInstallerInstallOnNextLaunchTest(context: TestContext, toolsets: ToolsetConfig): Promise<voi | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 1318 | export async function runWebInstallerRejectedTest(context: TestContext, toolsets: ToolsetConfig): Promise<void> { | CODE |
| LOW | test/src/updater/installOnNextLaunchTest.ts | 569 | async function createPackagedNsisUpdater(version: string, context: { tmpDir: import("temp-file").TmpDir }) { | CODE |
| LOW | test/src/updater/blackboxInstallWindows.ts | 36 | export async function clearWindowsUpdaterCaches(): Promise<void> { | CODE |
| LOW | test/src/updater/blackboxInstallWindows.ts | 54 | export async function waitForWindowsProcessExit(imageName: string, timeoutMs = 2 * 60 * 1000): Promise<void> { | CODE |
| LOW | test/src/updater/blackboxInstallWindows.ts | 102 | export async function describeWindowsInstallDir(appPath: string): Promise<string> { | CODE |
| LOW | test/src/updater/blackboxInstallWindows.ts | 122 | export async function resetWindowsNativeInstall(installerImageName: string, pathsToRemove: ReadonlyArray<string> = []): | CODE |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 39 | function expectVerificationSuccess(result: VerifyUpdateFileResult): void { | CODE |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 43 | function expectVerificationFailure(result: VerifyUpdateFileResult): string { | CODE |
| LOW | test/src/updater/blackboxUpdateLinuxSuite.ts | 16 | export function registerBlackboxLinuxTests(toolset: Required<Pick<ToolsetConfig, "appimage">>): void { | CODE |
| LOW | test/src/updater/blackboxUpdateLinuxSuite.ts | 67 | export function registerBlackboxLinuxPackageManagerTests(): void { | CODE |
| LOW | test/src/updater/blackboxUpdateWinSuite.ts | 39 | function isLatestToolsetExceptNsis(toolsets: Required<Pick<ToolsetConfig, "winCodeSign" | "wine">>): boolean { | CODE |
| LOW | test/src/updater/blackboxUpdateWebWinSuite.ts | 13 | export function registerBlackboxWebWinUpdateTests(toolsets: WebWinToolsets): void { | CODE |
| LOW | test/src/updater/blackboxUpdateWebWinSuite.ts | 38 | export function registerBlackboxWebWinNextLaunchTests(toolsets: WebWinToolsets): void { | CODE |
| LOW | test/src/updater/blackboxUpdateWebWinSuite.ts | 52 | export function registerBlackboxWebWinRejectedTests(toolsets: WebWinToolsets): void { | CODE |
| LOW | test/src/updater/differentialUpdateWinSuite.ts | 12 | export function registerDifferentialWinTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/mac/keychainPartitionListTest.ts | 56 | function keychainPasswordFromCalls(): string { | CODE |
| LOW | test/src/mac/macArchive.e2e.ts | 25 | function createMacFrameworkSymlinkTest(expect: ExpectStatic, format: "zip" | "7z") { | CODE |
| LOW | test/src/linux/linuxPackagerTestSuite.ts | 19 | export function registerLinuxPackagerTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/windows/winCodeSignTest.ts | 29 | function makeSignQueueTestPackager(signIfResults: SignIfResult[]) { | CODE |
| LOW | test/src/windows/winCodeSignTest.ts | 51 | function makeSequentialSignTestPackager() { | CODE |
| LOW | test/src/windows/squirrelWindowsTestSuite.ts | 8 | export function registerSquirrelWindowsTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/windows/winSignToolManagerTest.ts | 930 | async function writeNoCommonNameCertificate(tmpDir: TmpDir): Promise<string> { | CODE |
| LOW | test/src/windows/winSignToolManagerTest.ts | 959 | async function expectMissingPublisherNameError(manager: SigntoolBaseSignManager) { | CODE |
| LOW | test/src/windows/assistedInstallerTestSuite.ts | 10 | export function registerAssistedInstallerTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/helpers/updaterTestUtil.ts | 74 | export function createVerifyUpdateFileMock(onVerify: (params: Parameters<VerifyUpdateFile>[0]) => VerifyUpdateFileResult | CODE |
| LOW | test/src/helpers/updaterTestUtil.ts | 105 | export async function expectVerifyUpdateFileFailure({ | CODE |
| LOW | test/src/helpers/selfSignedIdentity.ts | 46 | export async function createSelfSignedCodeSigningIdentity(commonName: string, tmpDir: TmpDir, options: SelfSignedIdentit | CODE |
| LOW | test/src/helpers/launchAppCrossPlatform.ts | 486 | export async function deliverAndInstallSnapInVm(vm: VmManager, snapPath: string, opts: VmSnapOptions): Promise<{ version | CODE |
| LOW | test/src/helpers/launchAppCrossPlatform.ts | 574 | export async function installAndLaunchSnapLocally(snapPath: string, opts: VmSnapOptions): Promise<{ version: string }> { | CODE |
| LOW | test/src/helpers/downloadElectron.ts | 41 | export function downloadAllRequiredElectronVersions(): Promise<any> { | CODE |
| LOW | test/src/helpers/packTester.ts | 57 | export function getPackageManagerWithVersion(pm: PM, packageManagerAndVersionString?: string) { | CODE |
| LOW | test/src/helpers/packTester.ts | 93 | function getIgnoreScriptsInstallArgs(pm: PM): Array<string> { | CODE |
| LOW | test/src/helpers/packTester.ts | 129 | async function writePackageManagerSettings(projectDir: string, appDir: string, pm: PM, settings: Record<string, any> | u | CODE |
| LOW | test/src/helpers/packTester.ts | 216 | function getLockfileFixtureNameCandidates(currentTestName: string): Array<string> { | CODE |
| LOW | test/src/helpers/packTester.ts | 1087 | export async function getWindowsSigningIdentity(): Promise<SelfSignedIdentity> { | CODE |
| LOW | test/src/helpers/packTester.ts | 1101 | export async function expectedWindowsPublisherName(expect: ExpectStatic): Promise<Array<unknown>> { | CODE |
| LOW | test/src/helpers/providerTestUtil.ts | 38 | export function assertDownloadNotTriggered(expect: ExpectStatic, result: any, actualEvents: string[]): void { | CODE |
| LOW | test/src/helpers/windowsSignedFixture.ts | 150 | export async function cleanupWindowsSignedFixture(): Promise<void> { | CODE |
| LOW | packages/electron-updater/src/types.ts | 186 | export function verificationFailureMessage(result: VerifyUpdateFileResult | null | undefined): string | null { | CODE |
| 123 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/vitest-scripts/vitest-config/vitest-tmpdir.ts | 1 | import { afterEach, beforeEach } from "vitest" | COMMENT |
| LOW | test/src/HoistTest.ts | 81 | // it(`should support simple cyclic peer dependencies`, () => { | COMMENT |
| LOW | test/src/HoistTest.ts | 101 | COMMENT | |
| LOW | test/src/HoistTest.ts | 121 | } | COMMENT |
| LOW | test/src/HoistTest.ts | 261 | // . -> A -> B | COMMENT |
| LOW | test/src/HoistTest.ts | 381 | // -> F -> G -> B@X -> C@X -> D@X | COMMENT |
| LOW | test/src/HoistTest.ts | 421 | "B@X#1": { dependencies: [`C@Y`], peerNames: [`C`] }, | COMMENT |
| LOW | test/src/HoistTest.ts | 521 | // -> B@X | COMMENT |
| LOW | test/src/differentialOneLineBenchTest.ts | 1 | // Benchmark: what does a ONE-LINE source change under app.asar cost on the wire with | COMMENT |
| LOW | test/src/differentialOneLineBenchTest.ts | 21 | // | COMMENT |
| LOW | test/src/blockmapTest.ts | 201 | // Every test here ALWAYS runs the JS implementation and snapshots its output. | COMMENT |
| LOW | test/src/asarIntegrityTest.ts | 1 | import { Platform } from "app-builder-lib" | COMMENT |
| LOW | test/src/updater/test-specific-platforms.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 101 | data.SignatureType = 1 | COMMENT |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 621 | // E2e tests — Windows only, real PowerShell | COMMENT |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 701 | // The $OutputEncoding + [Console]::OutputEncoding setup must handle non-ASCII dir names. | COMMENT |
| LOW | test/src/updater/blackboxUpdateWinSuite.ts | 221 | // the update info of a per-machine build has isAdminRightsRequired, so the update installer is started through | COMMENT |
| LOW | test/src/linux/snapHeavy.e2e.ts | 21 | } | COMMENT |
| LOW | test/src/linux/test-snap.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/src/linux/test-snap.sh | 21 | # | COMMENT |
| LOW | test/src/linux/test-snap.sh | 61 | export TEST_FILES="${TEST_FILES:-snapTest,snapHeavy}" | COMMENT |
| LOW | test/src/helpers/packTester.ts | 101 | // | COMMENT |
| LOW | test/src/helpers/windowsSignedFixture.ts | 1 | import { appendFile, copyFile, writeFile } from "fs/promises" | COMMENT |
| LOW | website/docusaurus.config.ts | 41 | // Base URL of *this* instance. build-versioned-site.sh sets DOCS_BASE_URL per | COMMENT |
| LOW | website/scripts/build-versioned-site.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | website/scripts/build-versioned-site.sh | 21 | # sub-path comes from the matching config entry when | COMMENT |
| LOW | …-updater/src/windowsExecutableCodeSignatureVerifier.ts | 1 | import { parseDn } from "builder-util-runtime" | COMMENT |
| LOW | …-builder-squirrel-windows/src/SquirrelWindowsTarget.ts | 21 | this.options = packager.getOptionsForTarget<SquirrelWindowsOptions>("squirrelWindows") | COMMENT |
| LOW | …/src/node-module-collector/pnpmNodeModulesCollector.ts | 181 | // land at `<root>/node_modules/A/node_modules/B` — downward BFS is needed to find them. | COMMENT |
| LOW | packages/app-builder-lib/src/util/electronGet.ts | 481 | if (stateData?.state === CacheState.complete) { | COMMENT |
| LOW | packages/app-builder-lib/src/util/toolsetLock.ts | 41 | // invocation reserves a large `WebAssembly.Memory`. A single build converting one icon is fine, but | COMMENT |
| LOW | …ges/app-builder-lib/src/util/config/schemaValidator.ts | 21 | // unsupported or typo'd key validates here and is then dropped at build time with no error. | COMMENT |
| LOW | …kages/app-builder-lib/src/targets/blockmap/blockmap.ts | 1 | import { createHash } from "crypto" | COMMENT |
| LOW | packages/builder-util-runtime/src/uuid.ts | 221 | COMMENT | |
| LOW | .github/actions/pretest/action.yml | 101 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/src/helpers/launchAppCrossPlatform.ts | 521 | elif [ -n "\$XVFB_BIN" ]; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 335 | elif [ -x /usr/bin/kdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 337 | elif [ -x /usr/bin/Xdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 351 | elif [ -x /usr/bin/kdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 353 | elif [ -x /usr/bin/Xdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 386 | elif [ -x /usr/bin/Xdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 389 | elif [ -x /usr/bin/kdialog ] ; then | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/src/ArtifactPublisherTest.ts | 138 | username: "user@example.com", | CODE |
| LOW | test/src/cliTest.ts | 212 | expect(quoteString("Acme Corp")).toBe("Acme Corp") | CODE |
| LOW | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 51 | publisherName: ["Acme Corp"], | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 63 | expect(verifyHook).toHaveBeenCalledWith(["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 72 | publisherName: "Acme Corp" as any, | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 81 | expect(verifyHook).toHaveBeenCalledWith(["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 106 | publisherName: ["Acme Corp"], | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 123 | expect(verifyHook).toHaveBeenNthCalledWith(1, ["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 125 | const newGetterMethodResult = await updater.verifyUpdateFileAuthenticodeSignature(["Acme Corp"], "/path/to/install | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 128 | expect(verifyHook).toHaveBeenNthCalledWith(2, ["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 130 | const legacyGetterMethodResult = await updater.verifyUpdateCodeSignature(["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 133 | expect(verifyHook).toHaveBeenNthCalledWith(3, ["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 143 | const newGetterMethodResult = await updater.verifyUpdateFileAuthenticodeSignature(["Acme Corp"], "/path/to/install | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 146 | const legacyGetterMethodResult = await updater.verifyUpdateCodeSignature(["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 157 | await expect(updater.verifyUpdateCodeSignature(["Acme Corp"], "/path/to/installer.exe")).resolves.toBe("unknown er | CODE |
| LOW | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 167 | await expect(updater.verifyUpdateCodeSignature(["Acme Corp"], "/path/to/installer.exe")).resolves.toBe("unknown er | CODE |
| LOW | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 179 | await expect(updater.verifyUpdateCodeSignature(["Acme Corp"], "/path/to/installer.exe")).resolves.toBe("nope") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 198 | publisherName: ["Acme Corp"], | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 207 | expect(nativeVerifier).toHaveBeenCalledWith(["Acme Corp"], "/path/to/installer.exe") | CODE |
| LOW⚡ | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 215 | publisherName: ["Acme Corp"], | CODE |
| LOW | test/src/updater/nsisUpdaterSignatureGuardTest.ts | 226 | await expect(updater.verifyUpdateCodeSignature(["Acme Corp"], "/path/to/installer.exe")).resolves.toBeNull() | CODE |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 266 | expectVerificationSuccess(await verifySignature(["Acme Corp"], defaultFile, logger)) | CODE |
| LOW | …/updater/windowsExecutableCodeSignatureVerifierTest.ts | 267 | expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining("Acme Corp")) | CODE |
| LOW⚡ | test/src/windows/winSignToolManagerTest.ts | 801 | commonName: "Acme Corp", | CODE |
| LOW⚡ | test/src/windows/winSignToolManagerTest.ts | 807 | expect(publisherNameMatchesCertificate(["Acme Corp"], acmeCertInfo)).toBe(true) | CODE |
| LOW | test/src/windows/winSignToolManagerTest.ts | 832 | expect(publisherNameMatchesCertificate(["Old Corp Name", "Acme Corp"], acmeCertInfo)).toBe(true) | CODE |
| LOW | test/src/windows/winSignToolManagerTest.ts | 854 | const manager = makeValidationManager({ type: "signtool", publisherName: "Acme Corp" }, acmeCertInfo) | CODE |
| LOW | test/src/windows/winSignToolManagerTest.ts | 872 | const manager = makeValidationManager({ type: "signtool", publisherName: ["Old Corp Name", "Acme Corp"] }, acmeCertI | CODE |
| LOW | test/src/windows/winSignToolManagerTest.ts | 1024 | ["certificateSubjectName", { type: "signtool", sign: "./customSign.js", certificateSubjectName: "Acme Corp" }, {}], | CODE |
| LOW | website/docs/features/build-lifecycle.md | 305 | xml = xml.replace('Manufacturer="PLACEHOLDER"', 'Manufacturer="Acme Corp"') | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | MIGRATION.md | 15 | ### Step 0: run the automated migrator | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 69 | // Step 1: Start the HTTP server first so we know the port before building. | COMMENT |
| LOW⚡ | test/src/updater/blackboxWebInstallerTest.ts | 85 | // Step 2: Build the nsis-web installer with the server URL baked in. | COMMENT |
| LOW⚡ | test/src/updater/blackboxWebInstallerTest.ts | 90 | // Step 3: Copy the .nsis.7z app package into the HTTP server root so the | COMMENT |
| LOW | website/docs/migration/v26-to-v27.md | 27 | ## Step 1: Run the automated migrator | COMMENT |
| LOW | website/docs/migration/v26-to-v27.md | 99 | ## Step 2: Update Node.js | COMMENT |
| LOW | website/docs/migration/v26-to-v27.md | 149 | ## Step 3: Apply the manual steps | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 249 | // Step 1: D = ID byte repeated v times | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 252 | // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 259 | // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 266 | // Step 4: I = S || P (mutable, updated in step 6C) | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 391 | // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container. | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 410 | // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 69 | // Step 1: Start the HTTP server first so we know the port before building. | COMMENT |
| LOW⚡ | test/src/updater/blackboxWebInstallerTest.ts | 85 | // Step 2: Build the nsis-web installer with the server URL baked in. | COMMENT |
| LOW⚡ | test/src/updater/blackboxWebInstallerTest.ts | 90 | // Step 3: Copy the .nsis.7z app package into the HTTP server root so the | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 249 | // Step 1: D = ID byte repeated v times | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 252 | // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 259 | // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 266 | // Step 4: I = S || P (mutable, updated in step 6C) | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 391 | // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container. | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 410 | // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/app-builder-lib/scheme.json | 2381 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 3045 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 3540 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| LOW | packages/app-builder-lib/scheme.json | 4546 | "description": "The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants) | CODE |
| LOW | packages/app-builder-lib/scheme.json | 4906 | "description": "The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants) | CODE |
| LOW | packages/app-builder-lib/scheme.json | 5908 | "description": "The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants) | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 8822 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 9865 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](https: | CODE |
| LOW | packages/app-builder-lib/src/options/pkgOptions.ts | 66 | * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). In addition to `txt | COMMENT |
| MEDIUM | …uilder-lib/src/options/PlatformSpecificBuildOptions.ts | 112 | You can use [file macros](https://www.electron.build/file-patterns#file-macros) in the `from` and `to` fields as well. ` | CODE |
| LOW | …es/app-builder-lib/src/targets/win/nsis/nsisOptions.ts | 154 | * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). In addition to `txt | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/src/concurrentBuilds.e2e.ts | 156 | // Regression test for #9852: elevate.exe must reach the dir-target output (win-unpacked/resources) | COMMENT |
| MEDIUM | test/src/helpers/archiveHelper.ts | 5 | // listing (`-slt`), which prints one `Path = <entry>` line per entry — robust against entry names | COMMENT |
| MEDIUM | …/src/node-module-collector/yarnNodeModulesCollector.ts | 6 | // Instead of parsing Yarn's custom NDJSON output, we leverage npm's list command | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/src/linux/test-snap.sh | 132 | # Set SNAP_CORE to test a single core (ideal for CI matrix jobs). | COMMENT |
| LOW | …kages/app-builder-lib/templates/snap/desktop-common.sh | 124 | # Set XDG_DATA_HOME to local path | COMMENT |
| LOW | …kages/app-builder-lib/templates/snap/desktop-common.sh | 189 | # Check if we can actually read the contents of each xdg dir | COMMENT |